batch_get_exploits
Retrieve multiple exploits efficiently in one call
LABSCO SUMMARY
A local copy, so the searching is free and the pivots are cheap.
Once the database is built, everything runs against SQLite on your own machine: no API key, no rate limit, and no reason not to run five variations of a query. That is what makes the pivot tools worth having — comparing exploits side by side, walking related entries by author or platform, and exporting the result set to CSV are all things you avoid doing against a rate-limited web interface. Budget several minutes for the first npm run update-db, and set UPDATE_INTERVAL so the copy does not quietly go stale.
What it is
An MCP server that keeps a local SQLite copy of the Exploit Database and exposes 18 tools over it. Because the data is local, queries are fast and free, and the copy refreshes on a schedule you set. The database it builds typically holds more than 46,000 exploits from 1988 onward, across 60+ platforms.
What you get
- General search with combined filters — keyword, platform, type, CVE, author, date range, verified status and pagination — plus a single exploit fetched in full, with its code if you ask for it —
search_exploits,get_exploit - Every exploit tied to a CVE, and the most recently added entries —
find_by_cve,get_recent_exploits - Targeted searches by platform, by exploit type (webapps, remote, local, dos, hardware), by author, by date range, and by generated tags such as sql injection or xss —
search_by_platform,search_by_type,search_by_author,search_by_date_range,search_by_tags - Distribution statistics for the whole database or one platform, additions over a configurable recent window, and a chronological timeline —
get_statistics,get_platform_statistics,get_trending_exploits,get_exploit_timeline - Several exploits compared side by side, related entries found by platform, author, CVE or tag, and up to 50 records fetched in one batch —
compare_exploits,get_related_exploits,batch_get_exploits - An id checked for existence before you build on it, and a result set exported as JSON or CSV —
validate_exploit_id,export_search_results
Requirements
No account and no key — the data comes from the public Exploit Database CSV or its GitLab repository. Node.js v16 or higher and npm v7 or higher. Install from a clone with npm install and npm run build, then run npm run update-db once to build the local database; that first load takes several minutes because it processes roughly 47,000 records. DB_PATH and DATA_DIR set where the SQLite file lives, UPDATE_INTERVAL sets the refresh in hours with 0 disabling it, and MAX_RESULTS caps results per query at 10 by default — raise it before running a broad export.
Setup effort
Build from source — git clone https://github.com/Cyreslab-AI/exploitdb-mcp-server.git
USE CASES
01
Checking whether a CVE has public exploit code
Look the CVE up for every associated entry, then pull the one that matters in full with its code included — the answer that decides how urgently you patch.
02
Assessing exposure on one platform
Search that platform filtered to verified web application entries, and read the platform statistics to see how the risk is distributed by type and year.
03
Watching what has appeared recently
Pull additions over the last 30 days and place them on a timeline, so a spike against one product is visible rather than buried.
04
Understanding a technique rather than a single bug
Search by tag for the class of issue, compare several entries side by side, and walk related exploits by author or platform to see how the technique evolved.
05
Handing a result set to someone who is not in the chat
Run the search once and export the matches as CSV or JSON for a ticket, a report or a spreadsheet.
18 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
compare_exploits
Compare multiple exploits side-by-side
export_search_results
Export search results in various formats (JSON, CSV)
find_by_cve
Find exploits by CVE ID
get_exploit
Get detailed information about a specific exploit
get_exploit_timeline
Get chronological timeline of exploits for a CVE or search term
get_platform_statistics
Get detailed statistics for a specific platform
get_recent_exploits
Get recently added exploits
get_related_exploits
Find exploits related to a specific exploit (same platform, similar CVE, etc.)
get_statistics
Get statistics about the exploits in the database
get_trending_exploits
Find recently added exploits (last 30 days by default)
search_by_author
Find all exploits by a specific author
search_by_date_range
Find exploits within a specific date range
search_by_platform
Search exploits for a specific platform with advanced filters
search_by_tags
Search exploits by generated tags (e.g., sql injection, xss, buffer overflow)
search_by_type
Search exploits by type (webapps, remote, local, dos, hardware)
search_exploits
Search for exploits in the ExploitDB database
validate_exploit_id
Check if an exploit ID exists and is valid
BEFORE YOU INSTALL
What to know first
Tools you get
18 tools when we connected. All 18 tools query a local database that stays empty until npm run update-db runs once; it refreshes on UPDATE_INTERVAL, 24 hours by default.
Requires
- Node.js (v16 or higher)
- npm (v7 or higher)
- Internet access to download the public ExploitDB CSV when the database is built and refreshed
Where it runs
The documented client runs the server on your machine.
CONTEXT COST
Light Standing cost
Rated by the size of the 18 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Server setup
Clone the repository
TERMINAL
git clone https://github.com/Cyreslab-AI/exploitdb-mcp-server.git
cd exploitdb-mcp-serverInstall dependencies
TERMINAL
npm installBuild the project
TERMINAL
npm run buildInitialize the database
TERMINAL
npm run update-dbMCP Clients
Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"mcp-exploitdb-server": {
"command": "node",
"args": [
"<YOUR_PATH_TO_EXPLOITDB_MCP_SERVER>/build/index.js"
]
}
}
}<YOUR_PATH_TO_EXPLOITDB_MCP_SERVER> is the absolute path of the folder you cloned. build/index.js exists only after npm run build, and npm run update-db must have run once to fill the database.
